Preparing for disaster: A business guide to June 1

When the season’s first storm hits, it will be too late. Businesses will be tested, perhaps pushed to their limits, and the need for continuity plans will be painfully apparent.

The likely havoc will vindicate the time and expense of those who had the foresight to plan for the event. Anyone without those plans may rue the day, standing as witness to the cliché: “The failure to plan is a plan for failure.”

The effort to achieve business continuity, to limit recovery time and guarantee integrity of paperwork, records and IT systems, is indispensable.

“It is always best to be prepared. A disaster – whether a hurricane, a fire or data loss – can be devastating for a small business if there is no plan in place to address the situation,” says Wil Pineau, CEO of the Chamber of Commerce.

Mr. Pineau is not simply offering good advice to the 456 Chamber members who fall into government’s “small business” category. He represents the Chamber as chairman of the subcommittee on Economic Continuity, one of 16 such special-purpose groups mandated in the 18-volume National Hazard Management Plan, developed to address responses to a range of disasters – hurricane, tsunami, air crashes, pandemics, port emergencies, earthquakes, oil spills and others.

Economic continuity is key

Economic Continuity, part of a larger group under the rubric of “support services,” specifically addresses business continuity, designed “to provide liaison with the business community, provide synergy between private[-sector] and public-sector efforts during response and recovery operations,” the plan says.

“Business continuity for the private sector will be a main focus of the subcommittee.”

The document names the Chamber, headed by Mr. Pineau, as chair, and lists as members the Cayman Contractors Association and government’s Finance Department, Risk Management Unit, Budget Management Unit, the Cayman Islands Monetary Authority and the director of the Port Authority.

“I’ve been the chair for years,” Mr. Pineau says, “since Hurricane Ivan, really,” ample time to develop a comprehensive set of actions a business should take to defend itself.

A straight line connects Mr. Pineau’s action plans – and the thousand-page Hazard Management Plan – and that with 2004 storm. In some respects, Cayman is still recovering from the unprecedented devastation … and government is determined never to be caught out again.

“Computers and data are essential for most businesses these days,” Mr. Pineau says.

“It is important to ensure that there are back-up resources available if a business temporarily needs to relocate to another location.

“Having data backed up to multiple locations that can be accessible via the Internet or the cloud is vital for ensuring a speedy recovery following any disaster.”

Multiple locations is the chief feature of business continuity plans at Maples and Calder, an international law firm with critical needs to preserve documents, records, communications and service integrity.

“We also have space at One Technology Square,” LIME‘s secure facility that offers its own Disaster Recovery as a Service program to the public. “We have a global chief information officer and all our records are backed up in a timely fashion.”

Each element of the Maples and Calder plan, in a sense, is interdependent. Top priority, she says, is the safety and well-being of staff:

“Your business depends on employees. Without them you can’t run a business.

“So the first thing you do is decide who are your critical personnel and the people essential to returning to business at a time of crisis.”

Maples and Calder evacuates its business-continuity team first, she said, before a storm arrives, ‘so we can get the business up at the new site.”

The firm handles global continuity demands out of an alternate international location, she says, although hesitant to name it, but Cayman personnel head for Miami “or where they’re not in the path of the hurricane.” If Miami is under threat, another U.S. city is the destination.

Maples and Calder operates evacuation flights for its 500 local staff, and has seven offices globally, each with their own continuity plans.

Disaster Recovery as a Service

At LIME’s One Technology Square, parent company Cable & Wireless, and its Business Solutions arm – following March’s $3 billion acquisition of Barbados-based and Caribbean-wide Columbus International – provides that Disaster Recovery as a Service data security and recovery service.

“There is little doubt that you have some sort of a business continuity and/or disaster recovery plan set for your business,” says C&W’s Business Solutions headline. “Is your disaster recovery and business continuity plan a disaster?”

“These plans must be a high priority …, but many companies unfortunately are going about them in the wrong way,” it says.

Disaster Recovery as a Service treats with caution Mr. Pineau’s suggestion that the cloud may offer a backup solution, warning “most major public clouds do not automatically back up your data. You actually have to purchase a backup product.”

In mid-February, Google experienced a 160-minute outage of its cloud. The breakdown came overnight in the U.S., but interfered with early business in London.

On Nov 18, Microsoft Azure’s cloud went down in a “massive outage,” according to on-line tech magazine Information Week. The interruption extended for hours in the U.S. and “deep into the next day” in Europe, disrupting the MSN website, Office 365, Xbox Live, a range of third-party services “as well as possible data-integrity problems,” the magazine reported.

The problems are not new. On April 21, 2011, Amazon’s cloud services went down for several hours, and, in some cases, a full day when “its Elastic Block Store service got stuck in a ‘re-mirroring storm,’” according to May’s computer re-seller news CRN.

And in mid-December 2013, Yahoo Mail outages left users unable to access their email for several days.

“The fallout from the Amazon cloud outage,” says the cwcbusiness.com website, “didn’t help dispel any fear around cloud security and downtime … [M]any customers questioned the reliability of the cloud.”

While C&W seeks to promote Disaster Recovery as a Service, it also correctly observes that businesses traditionally built disaster-recovery plans around copying data to tape, then moving those tapes to an offsite location, meaning at least a 24-hour delay – and often more – in recovery time, while incurring significant capital and operational expenses.

Ms. Bergstrom says that is not even remotely acceptable today: “You need to know the needs of your clients, and you potentially lose business the longer you are down, and the longer it takes you to come back, the more you lose.

“Your clients are going to go elsewhere,” she says, acknowledging, like any business owner, that once they are gone you are unlikely to win them back.

“In fact,” she says, “clients are requesting” recovery plans. “It’s at the forefront of a client’s mind. They want to know what you are doing for business continuity.”

Rapid recovery imperative

Observing the obvious, Mr. Pineau nonetheless underlines the financial imperative of rapid recovery: “Businesses are in the business of being open for business. When a disaster strikes businesses that have a robust and tested continuity plan will recover much sooner and will be able to restore operations.”

“Size does not matter in this case. Small businesses, however, are certainly more vulnerable if they have failed to plan for any form of business interruption.

“Large businesses,” he says, drawing a parallel with Maples and Calder, “will have elaborate plans that are usually developed with the assistance of the main corporate office. These plans consider every possible scenario in a disaster dealing with staff, equipment and remote operations and services, communications and client notification.”

By contrast, however, “small businesses are often unable to afford to spend a great deal of money developing a plan,” he says.

However, Mr. Pineau warns, “That does not mean they shouldn’t.”

Echoing Mr. Pineau, Ms. Bergstrom says Maples and Calder has not had to finance creation of its plan because bright, informed staffers have spent the time doing it internally.

“We have developed the plan over time, so it’s been gradual. Every year, we try to improve it, so it’s really done internally and the cost is minimal. It’s just the time for people, for support staff, to do it,” she says.

Otherwise, however, experts peg the average cost of a disaster-recovery plan at $110,000 during a three-year period, citing servers, software, operations expenses and support.

Disaster Recovery as a Service, says Cable & Wireless, can slash those costs to as little as $37,000, approximately $1,000 per month.

Describing its One Technology Square headquarters in Eastern Avenue as “largely impervious” Cable & Wireless says its experts and engineers in the “nerve center” work “through the duration of any natural disaster or technological failure” to ensure continuity of communications.

Checklist

Mr. Pineau offers a five-point checklist for small businesses to get started on a continuity plan:

It will consume time and incur costs, he concedes, but the alternatives are probably worse.

Recovery, he says, “depends on the severity of the storm and the overall impact on the Islands. Some disasters can take weeks and some can take many months. That’s why it is important to plan for all scenarios.

“Here are a couple of tips,” he offers, listing a dozen things to ponder:

“Plan ahead to minimize down time, and know how and where to access services,” he recommends.

“Keep resources at the ready” and, like Maples and Calder, which handles data as a lifeblood, “back up your data.”

Also like Maples and Calder, Mr. Pineau says, people are the most important asset of any business, large, small or otherwise: “Be sure to prepare and engage your most valuable assets — your staff.

“Protect important paper documents; and”, something that might not immediately occur to a proprietor, “keep a staff-contact list at home.

“Be aware of the details of your insurance policies. Have an inventory of equipment, assets and products,” he says.

“Prepare an emergency pack,” which, for a business, will include identity documents and cash, battery-operated radios and spare batteries.

“Ensure that you have a mobile phone for work purposes and your clients are aware of the number,” he says, drawing directly on formal published recommendations by the Austin, Texas, Division of Emergency Management.

“Sufficient flashlights and other battery-powered lights allow essential work to be conducted in the event of power outage, backed by a good supply of fresh batteries,” department recommendations continue.

Even an office emergency kit should include canned food, non-perishable and ready to eat; one gallon of water per person per day; a manual can opener and eating utensils; personal hygiene items; a first-aid kit; fire-protection equipment; rainwear; gloves; and blankets.

More protection

Windows and doors should be boarded up and braced, as the department observes the first priority is to keep out the wind.

Ms. Bergstrom says Maples and Calder has designated a small group of company personnel as fire-safety wardens, observing that “action plans are not limited to hurricanes, but should include earthquakes, flooding and other possible disasters.

“We do fire training and have designated two fire marshals for each floor and two first-aides on each floor.” Maples and Calder is spread across two buildings – Ugland House and Queensgate – and eight floors.

“We work on how to evacuate quickly, and without panic, how to work with the Fire Department. We do a lot of comprehensive training.”

Equally, she cautions, Maples and Calder has pondered the possibility of a pandemic, an event which takes up an entire volume in Hazard Management’s emergency plans.

“If you get bird flu,” Ms. Bergstrom says, “and are seeing it passed around, you want to isolate working staff, make sure they are decentralized. Who can work from home? What about their family members?

“Businesses, you see,” she finishes, “need to look at a crisis plan holistically.”